A method and apparatus for monitoring application programming interface functions
By introducing jump memory into the system and establishing the association between the hook module and the jump memory address, the problem of dynamic unloading and upgrading of the hook module when multiple security products coexist is solved, thus improving the stability and compatibility of the system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- QI AN XIN TECHNOLOGY GROUP INC
- Filing Date
- 2023-03-27
- Publication Date
- 2026-08-04
AI Technical Summary
In existing technologies, when multiple security products coexist, it is impossible to dynamically uninstall or upgrade the hook module, leading to system compatibility and stability issues.
By introducing jump memory into the system, a preset association between the hook module and the jump memory address is established, and the hook monitoring of the hook module is dynamically managed, avoiding direct reference to the function values of other hook modules and ensuring system stability.
Dynamic uninstallation and upgrade of the hook module were implemented, which improved the stability and compatibility of the system and prevented process crashes and system downtime.
Smart Images
Figure CN116560660B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer science and technology, and in particular to a method and apparatus for monitoring application programming interface functions. Background Technology
[0002] Programming on Windows systems typically involves using API (Application Programming Interface) functions. In the field of system endpoint security, security products often use techniques that hook monitoring onto API functions. This involves performing some monitoring and logging before the application calls the actual API function, and then calling the actual API function to complete the required functionality. When multiple security products coexist and their monitoring hooks onto the same API function, significant compatibility issues arise.
[0003] Existing API function monitoring technologies typically monitor API functions directly through hook modules, without using methods to establish hooks via jump memory. Therefore, dynamic uninstallation or upgrade of hook modules is not possible, impacting the availability of customer services.
[0004] Therefore, adding a jump board memory to enable hook module monitoring of application programming interface functions based on the jump board memory is a technical problem that urgently needs to be solved. Summary of the Invention
[0005] This invention provides a method and apparatus for monitoring application programming interface functions, which solves the defect in the prior art that the hook module cannot be dynamically unloaded or upgraded, and realizes the hook module's hook monitoring of application programming interface functions based on the jump board memory.
[0006] This invention provides a method for monitoring application programming interface functions, comprising:
[0007] When it is detected that the first hooking module needs to perform hooking monitoring on the application programming interface function, it is checked whether there is any second hooking module currently performing hooking monitoring on the application programming interface function;
[0008] If it does not exist, a hook is established between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the first hook module;
[0009] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0010] According to the application programming interface (API) function monitoring method provided by the present invention, after establishing a hook between the API function and the first hook module through a first association stored in a preset jumper memory address, the method further includes:
[0011] A second association is created between the preset jump board memory address and the application programming interface function in the preset jump board memory address, and the second association is saved.
[0012] According to a method for monitoring application programming interface functions provided by the present invention, the method further includes:
[0013] When it is detected that any second hook module needs to perform hook monitoring on the application programming interface function, it is detected whether the first hook module has unhooked from the application programming interface function;
[0014] If the connection is broken, a hook is established between the application programming interface function and the second hook module through the second association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the second hook module.
[0015] According to a method for monitoring application programming interface (API) functions provided by the present invention, after detecting whether any second hooking module is currently performing hooking monitoring on the API function, the method further includes:
[0016] If any second hooking module performs hooking monitoring on the application programming interface function, then the first hooking module will no longer perform hooking monitoring on the application programming interface function.
[0017] According to a method for monitoring application programming interface (API) functions provided by the present invention, when it is detected that any second hooking module needs to perform hooking monitoring on the API function, after detecting whether the first hooking module has unhooked from the API function, the method further includes:
[0018] If the first hook module is not unhooked from the application programming interface function, then the second hook module is loaded;
[0019] Establish a third association between the second hook module and the jump board memory address;
[0020] Based on the third association relationship and the second association relationship, a hook is established between the application programming interface function and the second hook module, and the hook of the application programming interface function is monitored through the second hook module.
[0021] According to the present invention, a method for monitoring application programming interface (API) functions includes: function address and function program;
[0022] The step of establishing a hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address includes:
[0023] Determine the function addresses and function routines of the application programming interface functions;
[0024] A fourth association relationship is established between the function address of the application programming interface function and the preset jump board memory address, and based on the first association relationship and the fourth association relationship, an association relationship is established between the function address and the first hook module;
[0025] Establish a hook between the first hook module and the function program of the application programming interface function.
[0026] The present invention also provides a monitoring device for application programming interface functions, comprising:
[0027] The detection unit is used to detect whether there is a second hook module currently performing hook monitoring on the application programming interface function when the first hook module is detected to need to perform hook monitoring on the application programming interface function.
[0028] The hook unit is used to establish a hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address if the hook does not exist, and to monitor the hook of the application programming interface function through the first hook module.
[0029] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0030] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the monitoring method of the application programming interface function as described above.
[0031] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the monitoring method of the application programming interface function as described above.
[0032] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of a monitoring method for application programming interface functions as described above.
[0033] The application programming interface (API) function monitoring method and apparatus provided by this invention uses a preset jump board memory to store a first association relationship between a first hook module and a jump board memory address. When it is detected that the first hook module needs to perform hook monitoring on the API function, it checks whether there is any second hook module currently performing hook monitoring on the API function. If not, it establishes a hook between the API function and the first hook module through the first association relationship stored in the preset jump board memory address, and performs hook monitoring on the API function through the first hook module, ensuring support for dynamic uninstallation or upgrade of the first hook module and improving system stability. Attached Figure Description
[0034] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0035] Figure 1 This is one of the flowcharts illustrating the method for monitoring application programming interface functions provided by this invention;
[0036] Figure 2 This is a schematic diagram of the state of the application programming interface function provided by this invention before it is hooked and monitored;
[0037] Figure 3 This is a schematic diagram of the state of the application programming interface function provided by the present invention after being monitored by the first hook module, which shows the first association between the jump memory and the first hook module;
[0038] Figure 4 This is the second flowchart illustrating the method for monitoring application programming interface functions provided by this invention;
[0039] Figure 5 This is one of the schematic diagrams showing the state of the application programming interface function provided by the present invention after the first hooking module has unhooked it;
[0040] Figure 6 This is the second schematic diagram of the state of the application programming interface function provided by the present invention after the first hooking module has unhooked it;
[0041] Figure 7 This is a schematic diagram showing the state of the application programming interface function provided by the present invention after it is monitored by the second hook module;
[0042] Figure 8This is the third flowchart illustrating the method for monitoring application programming interface functions provided by this invention;
[0043] Figure 9 This is a schematic diagram illustrating the state of the application programming interface function provided by the present invention being monitored by the first hook module and then by the second hook module;
[0044] Figure 10 This is the fourth flowchart illustrating the method for monitoring application programming interface functions provided by this invention;
[0045] Figure 11 This is a schematic diagram of the structure of the monitoring device for application programming interface functions provided by the present invention;
[0046] Figure 12 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0048] The following is combined with Figures 1-12 This invention describes a method and apparatus for monitoring application programming interface functions.
[0049] Figure 1 This is one of the flowcharts illustrating the method for monitoring application programming interface functions provided in this embodiment, such as... Figure 1 As shown, the method for monitoring application programming interface functions provided in this embodiment includes:
[0050] Step 100: When it is detected that the first hook module needs to perform hook monitoring on the application programming interface function, check whether there is any second hook module currently performing hook monitoring on the application programming interface function.
[0051] It should be noted that, Figure 2 This is a schematic diagram of the state of the application programming interface function provided in this embodiment before it is hooked for monitoring, such as... Figure 2 As shown, "func table ptr" represents a function address pointer, "f1 addr" represents the address of function f1, which points to the program of function f1, i.e., "f1 code", and "f2 addr" represents the address of function f2, which points to the program of function f2, i.e., "f2 code".
[0052] Step 200: If it does not exist, then establish a hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address, and monitor the hook of the application programming interface function through the first hook module;
[0053] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0054] Specifically, this embodiment pre-sets an intermediate module, namely a jump memory. The jump memory address has a preset first association relationship with the first hook module, which can ensure that the first hook module used for hooking and monitoring API functions can be dynamically uninstalled and upgraded.
[0055] It should be noted that in the scheme of this embodiment, the first hook module is a module that has a preset first association relationship with the jump board memory address, and the hook monitoring of the application programming interface function by the first hook module needs to be implemented through the jump board memory; the second hook module is a module that directly hooks and monitors the application programming interface function by itself.
[0056] Specifically, if it is detected that a second hook module or other modules that directly hook and monitor application programming interface functions have already hooked and monitored application programming interface functions, since the second hook module does not establish hooks based on jump memory addresses, if the first hook module continues to perform hook monitoring, it will directly reference the function values of the second hook module. After the second hook module is unloaded, the first hook module loses its reference basis, which may lead to process crash.
[0057] Therefore, to ensure system stability, if any second hook module is detected to be hooking the application programming interface function, the first hook module will no longer hook the application programming interface function; if no hook module is detected to be hooking the current application programming interface function, then the application programming interface function will be hooked again through the jump memory address and the first hook module.
[0058] Specifically, Figure 3 This is a schematic diagram illustrating the state of the application programming interface function provided in this embodiment after it has been monitored by the first hook module. It shows the first association between the jumper memory and the first hook module. The specific association is as follows: Figure 3As shown, "jmp h1" represents the address of the function h1 in the jump memory, pointing to the function program of the first hook module h1, i.e., "h1 code", and "jmp h2" represents the address of the function h2 in the jump memory, pointing to the function program of the first hook module h2, i.e., "h2 code". When it is detected that no hook module is monitoring the hooking of the current application programming interface function, a hook is established between the application programming interface function and the first hook module based on the jump memory settings and the first association between the jump memory address and the first hook module, thereby realizing the hooking monitoring of the application programming interface function by the first hook module.
[0059] The above describes the steps of the application programming interface (API) function monitoring method provided in this embodiment. As can be seen from the above description, according to the API function monitoring method provided in this embodiment, a first association relationship between a pre-set first hook module and a jump memory address is stored in a preset jump memory. When it is detected that the first hook module needs to perform hook monitoring on the API function, it is checked whether any second hook module is currently performing hook monitoring on the API function. If not, a hook is established between the API function and the first hook module through the first association relationship stored in the preset jump memory address, and the API function is monitored through the first hook module. This ensures support for the dynamic uninstallation or upgrade of the first hook module and improves system stability.
[0060] Based on the above embodiments, in this embodiment, after establishing the hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address in step 200, the method further includes:
[0061] A second association is created between the preset jump board memory address and the application programming interface function in the preset jump board memory address, and the second association is saved.
[0062] Specifically, such as Figure 3 As shown, before the first hook module performs hook monitoring on the application programming interface function, a first association relationship between the first hook module and the jump memory is preset; after the first hook module performs hook monitoring on the application programming interface function through the first association relationship stored in the preset jump memory address, a second association relationship between the jump memory address and the application programming interface function is created, so that other hook modules can perform hook monitoring on the application programming interface function based on the second association relationship.
[0063] The method for monitoring application programming interface functions provided in this embodiment creates a second association between a preset jumper memory address and the application programming interface function, which facilitates subsequent hooking monitoring of application programming interface functions by other hooking modules based on the second association.
[0064] Based on the above embodiments, in this embodiment... Figure 4 This is the second flowchart illustrating the method for monitoring application programming interface functions provided in this embodiment, as shown below. Figure 4 As shown, the method further includes:
[0065] Step 410: When it is detected that any second hook module needs to perform hook monitoring on the application programming interface function, detect whether the first hook module has unhooked from the application programming interface function.
[0066] It should be noted that when the first hook module is uninstalled, the address information of the jump board memory does not disappear, but is saved to the installation directory. When installing other hook modules, the jump board memory information can be directly read and reused, reducing costs. Figure 5 This is one of the schematic diagrams showing the state of the application programming interface function provided in this embodiment after the first hook module unhooks it, such as... Figure 5 As shown, after the first hook module is unloaded, the jump board memory still exists, and the jump board memory address is updated to "jmpf1" and "jmp f2".
[0067] Step 420: If the connection is released, a hook is established between the application programming interface function and the second hook module through the second association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the second hook module.
[0068] Specifically, Figure 6 This is the second schematic diagram of the state of the application programming interface function provided in this embodiment after the first hooking module unhooks it, as shown below. Figure 6 As shown, after the first hook module is unloaded, the jump board memory still exists. When it is detected that the first hook module has broken the hook relationship with the application programming interface function, the second hook module can directly read the jump board memory information, establish a hook between the application programming interface function and the second hook module according to the second association relationship between the current jump board memory address and the application programming interface function, and perform hook monitoring on the application programming interface function.
[0069] The method for monitoring application programming interface (API) functions provided in this embodiment monitors the API functions by the second hooking module through a second association stored in a preset jumper memory address after the first hooking module unhooks from the API function. This enables the dynamic unloading of the first hooking module and ensures the stability of the system.
[0070] Based on the above embodiments, in this embodiment, after step 100 detects whether any second hooking module is currently performing hooking monitoring on the application programming interface function, the method further includes:
[0071] If any second hooking module performs hooking monitoring on the application programming interface function, then the first hooking module will no longer perform hooking monitoring on the application programming interface function.
[0072] Specifically, Figure 7 This is a schematic diagram illustrating the state of the application programming interface function provided in this embodiment after it is monitored by the second hook module, such as... Figure 7 As shown, since the second hook module is installed first, there is no jumper memory. The address of the f1 function directly points to the f1 function program through the second hook module. Therefore, if it is detected that the application programming interface function has been hooked and monitored by other hook modules, the first hook module will no longer be used to hook and monitor the application programming interface function, thus avoiding system crashes.
[0073] The application programming interface function monitoring method provided in this embodiment will stop monitoring through the first hooking module when it is detected that the current application programming interface function has been hooked and monitored by other hooking modules, thereby avoiding system crashes and improving system stability.
[0074] Based on the above embodiments, in this embodiment... Figure 8 This is the third flowchart illustrating the monitoring method for application programming interface functions provided in this embodiment, as shown below. Figure 8 As shown, in step 410, when any second hook module is detected to need to perform hook monitoring on the application programming interface function, after detecting whether the first hook module has unhooked from the application programming interface function, the method further includes:
[0075] Step 810: If the first hook module is not unhooked from the application programming interface function, then load the second hook module.
[0076] Step 820: Establish a third association between the second hook module and the jump board memory address.
[0077] Step 830: Based on the third association relationship and the second association relationship, establish a hook between the application programming interface function and the second hook module, and monitor the hook of the application programming interface function through the second hook module.
[0078] It should be noted that when it is detected that the first hook module and the application programming interface function have not been unhooked, both the first hook module and the jumper memory exist. At this time, other hook modules can associate with the jumper memory to monitor the hook of the application programming interface function based on the jumper memory address.
[0079] Specifically, Figure 9 This is a schematic diagram illustrating the state of the application programming interface function provided in this embodiment after being monitored by the first hook module and then by the second hook module, as shown below. Figure 9 As shown, the second hook module is first loaded, thereby establishing a third association between the second hook module and the jump memory address. Since there is a second association between the jump memory address and the application programming interface function, a hook between the application programming interface function and the second hook module can be established based on the third and second associations, thereby enabling the second hook module to monitor the hook of the application programming interface function.
[0080] The method for monitoring application programming interface functions provided in this embodiment establishes a third association between the second hook module and the jumper memory address when the first hook module and the application programming interface function are not unhooked. The hook monitoring of the application programming interface function is realized by the third association and the second association. This method supports the dynamic uninstallation or upgrade of the first hook module and has high stability.
[0081] Based on the above embodiments, in this embodiment, the application programming interface function includes: a function address and a function program. Specifically, see [link to relevant documentation]. Figure 2 “func table ptr” represents a function address pointer, “f1 addr” represents the address of function f1, which points to the program of function f1, i.e., “f1 code”, and “f2 addr” represents the address of function f2, which points to the program of function f2, i.e., “f2 code”.
[0082] Figure 10 This is the fourth flowchart illustrating the monitoring method for application programming interface functions provided in this embodiment, as shown below. Figure 10 As shown, step 200 establishes a hook between the application programming interface function and the first hook module through the first association stored in the preset jumper memory address, including:
[0083] Step 1010: Determine the function address and function program of the application programming interface function.
[0084] Step 1020: Establish a fourth association between the function address of the application programming interface function and the preset jump board memory address, and establish an association between the function address and the first hook module based on the first association and the fourth association.
[0085] Specifically, see Figure 3 "jmp h1" represents the address of the function h1 in the jump memory, pointing to the function program of the first hook module h1, i.e., "h1 code". "jmp h2" represents the address of the function h2 in the jump memory, pointing to the function program of the first hook module h2, i.e., "h2 code". The function address of the application programming interface function points to the current jump memory address.
[0086] Step 1030: Establish a hook between the first hook module and the function program of the application programming interface function.
[0087] Specifically, when it is detected that no hooking module is performing hooking monitoring on the current application programming interface function, the function address and function program of the application programming interface function are first determined. The function address "f1 addr" of the application programming interface function is associated with the current jump board memory address "jump h1" to establish a fourth association relationship. Based on the first association relationship and the fourth association relationship, the association between the function address and the first hooking module is determined. Then, a hook is established between the first hooking module and the function program "f1 code" of the application programming interface function, thereby realizing the hooking monitoring of the application programming interface function by the first hooking module.
[0088] The method for monitoring application programming interface functions provided in this embodiment establishes a hook relationship between the first hook module and the function program of the application programming interface function by pre-setting the jump board memory and the first association relationship between the pre-set first hook module and the current jump board memory address, ensuring support for dynamic uninstallation or upgrade of the first hook module, with low cost and high stability.
[0089] The following compares and illustrates the processing results of existing solutions and the solution provided in this application under different coexistence scenarios. Assume that security product A monitors API functions through hook module A, and security product B monitors API functions through hook module B. Assume the following four scenarios exist:
[0090] Scenario 1: Install hook module A → Install hook module B → Uninstall hook module A → Uninstall hook module B;
[0091] Scenario 2: Install hook module A → Install hook module B → Uninstall hook module B → Uninstall hook module A;
[0092] Scenario 3: Install hook module B → Install hook module A → Uninstall hook module B → Uninstall hook module A;
[0093] Scenario 4: Install hook module B → Install hook module A → Uninstall hook module A → Uninstall hook module B.
[0094] The following three solutions exist in the existing technology:
[0095] Option 1: If hook module A has already hooked and monitored the API function, hook module B will no longer hook and monitor the current API function.
[0096] Option 2: If hook module A has already hooked and monitored the API function, hook module B continues to hook and monitor the current API function. When the function returns, it calls the system initial value. After hook module B is unloaded, the hook monitoring point is restored to the system initial value.
[0097] Option 3: If hook module A has already hooked and monitored the API function, hook module B continues to hook and monitor the current API function. When the processing function returns, it calls the function value of hook module A. When hook module B is unloaded, the hook monitoring point is restored to the function value of hook module A.
[0098] This solution: If hook module A (hook module of other security products) has already performed hook monitoring on the API function, hook module B (the first hook module in this application) will no longer perform hook monitoring on the current API function; when there is no conflict, the current API function is hooked to the first hook module through the current jump board memory address, so as to perform hook monitoring on the API function through the current jump board memory address and the first hook module.
[0099] Table 1 shows the processing results of different schemes in different scenarios. For details, please refer to Table 1.
[0100] Table 1
[0101]
[0102]
[0103] As can be seen, in the compared schemes, due to the absence of a jumper memory, if the hook module installed later directly calls the functions of the hook module installed earlier, a system crash may occur after the hook module installed earlier is uninstalled. This results in poor system compatibility and stability, and makes it impossible to dynamically uninstall or upgrade the hook module.
[0104] The application programming interface (API) function monitoring method provided in this embodiment of the invention stores a first association relationship between a pre-set first hook module and a jump memory address in a preset jump memory. When it is detected that the first hook module needs to perform hook monitoring on the API function, it checks whether there is any second hook module currently performing hook monitoring on the API function. If not, it establishes a hook between the API function and the first hook module through the first association relationship stored in the preset jump memory address, and performs hook monitoring on the API function through the first hook module, ensuring support for dynamic uninstallation or upgrade of the first hook module and improving system stability.
[0105] The monitoring device for application programming interface functions provided by the present invention will be described below. The monitoring device for application programming interface functions described below and the monitoring method for application programming interface functions described above can be referred to in correspondence.
[0106] Figure 11 This is a schematic diagram of the monitoring device for the application programming interface functions provided in this embodiment, such as... Figure 11 As shown, the application programming interface function monitoring device provided in this embodiment includes:
[0107] The detection unit 1101 is used to detect whether there is any second hook module currently performing hook monitoring on the application programming interface function when the first hook module is detected to need to perform hook monitoring on the application programming interface function;
[0108] Hook unit 1102 is used to establish a hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address if the hook does not exist, and to monitor the hook of the application programming interface function through the first hook module.
[0109] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0110] The application programming interface (API) function monitoring device provided in this embodiment stores a first association relationship between a pre-set first hook module and a jump memory address in a preset jump memory. When it is detected that the first hook module needs to perform hook monitoring on the API function, it checks whether there is any second hook module currently performing hook monitoring on the API function. If not, it establishes a hook between the API function and the first hook module through the first association relationship stored in the preset jump memory address, and performs hook monitoring on the API function through the first hook module, ensuring support for dynamic uninstallation or upgrade of the first hook module and improving system stability.
[0111] Based on the above embodiments, in this embodiment, the device further includes:
[0112] The second association unit is used to establish a hook between the application programming interface function and the first hook module by means of a first association stored in a preset jump memory address, and then create a second association between the preset jump memory address and the application programming interface function in the preset jump memory address and save the second association.
[0113] Based on the above embodiments, in this embodiment, the hook unit 1102 is specifically used for:
[0114] When it is detected that any second hook module needs to perform hook monitoring on the application programming interface function, it is detected whether the first hook module has unhooked from the application programming interface function;
[0115] If the connection is broken, a hook is established between the application programming interface function and the second hook module through the second association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the second hook module.
[0116] Based on the above embodiments, in this embodiment, the detection unit 1101 is specifically used for:
[0117] After detecting whether any second hooking module is currently performing hooking monitoring on the application programming interface function, if any second hooking module is performing hooking monitoring on the application programming interface function, then the first hooking module will no longer perform hooking monitoring on the application programming interface function.
[0118] Based on the above embodiments, in this embodiment, the hook unit 1102 is specifically used for:
[0119] When it is detected that any second hook module needs to perform hook monitoring on the application programming interface function, the system checks whether the first hook module has unhooked from the application programming interface function.
[0120] If the first hook module is not unhooked from the application programming interface function, then the second hook module is loaded;
[0121] Establish a third association between the second hook module and the jump board memory address;
[0122] Based on the third association relationship and the second association relationship, a hook is established between the application programming interface function and the second hook module, and the hook of the application programming interface function is monitored through the second hook module.
[0123] Based on the above embodiments, in this embodiment, the application programming interface function includes: a function address and a function program;
[0124] The hook unit 1102 is specifically used for:
[0125] Determine the function addresses and function routines of the application programming interface functions;
[0126] A fourth association relationship is established between the function address of the application programming interface function and the preset jump board memory address, and based on the first association relationship and the fourth association relationship, an association relationship is established between the function address and the first hook module;
[0127] Establish a hook between the first hook module and the function program of the application programming interface function.
[0128] Figure 12 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 12 As shown, the electronic device may include: a processor 1210, a communications interface 1220, a memory 1230, and a communication bus 1240, wherein the processor 1210, the communications interface 1220, and the memory 1230 communicate with each other via the communication bus 1240. The processor 1210 can call logical instructions in the memory 1230 to execute a monitoring method of an application programming interface function, the method including:
[0129] When it is detected that the first hooking module needs to perform hooking monitoring on the application programming interface function, it is checked whether there is any second hooking module currently performing hooking monitoring on the application programming interface function;
[0130] If it does not exist, a hook is established between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the first hook module;
[0131] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0132] Furthermore, the logical instructions in the aforementioned memory 1230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0133] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is capable of executing the monitoring method of the application programming interface functions provided by the above methods, the method comprising:
[0134] When it is detected that the first hooking module needs to perform hooking monitoring on the application programming interface function, it is checked whether there is any second hooking module currently performing hooking monitoring on the application programming interface function;
[0135] If it does not exist, a hook is established between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the first hook module;
[0136] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0137] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a monitoring method for performing the application programming interface functions provided by the methods described above, the method comprising:
[0138] When it is detected that the first hooking module needs to perform hooking monitoring on the application programming interface function, it is checked whether there is any second hooking module currently performing hooking monitoring on the application programming interface function;
[0139] If it does not exist, a hook is established between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the first hook module;
[0140] The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
[0141] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0142] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A monitoring method of an application programming interface function, characterized by, include: When it is detected that the first hooking module needs to perform hooking monitoring on the application programming interface function, it is checked whether there is any second hooking module currently performing hooking monitoring on the application programming interface function; If it does not exist, a hook is established between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the first hook module; The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
2. The monitoring method of application programming interface functions according to claim 1, characterized in that, After establishing the hook between the application programming interface function and the first hook module through the first association stored in the preset jumper memory address, the method further includes: A second association is created between the preset jump board memory address and the application programming interface function in the preset jump board memory address, and the second association is saved.
3. The monitoring method of application programming interface functions according to claim 2, characterized in that, The method further includes: When it is detected that any second hook module needs to perform hook monitoring on the application programming interface function, it is detected whether the first hook module has unhooked from the application programming interface function; If the connection is broken, a hook is established between the application programming interface function and the second hook module through the second association stored in the preset jump board memory address, and the hook monitoring of the application programming interface function is performed through the second hook module.
4. The monitoring method of application programming interface functions according to claim 1, characterized in that, After detecting whether any second hooking module is currently hooking the application programming interface function, the method further includes: If any second hooking module performs hooking monitoring on the application programming interface function, then the first hooking module will no longer perform hooking monitoring on the application programming interface function.
5. The monitoring method of application programming interface functions according to claim 3, characterized in that, When it is detected that any second hook module needs to perform hook monitoring on the application programming interface function, after detecting whether the first hook module has unhooked from the application programming interface function, the method further includes: If the first hook module is not unhooked from the application programming interface function, then the second hook module is loaded; Establish a third association between the second hook module and the jump board memory address; Based on the third association relationship and the second association relationship, a hook is established between the application programming interface function and the second hook module, and the hook of the application programming interface function is monitored through the second hook module.
6. The monitoring method of application programming interface functions according to claim 1, characterized in that, The application programming interface functions include: function addresses and function routines; The step of establishing a hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address includes: Determine the function addresses and function routines of the application programming interface functions; A fourth association relationship is established between the function address of the application programming interface function and the preset jump board memory address, and based on the first association relationship and the fourth association relationship, an association relationship is established between the function address and the first hook module; Establish a hook between the first hook module and the function program of the application programming interface function.
7. A monitoring device for application programming interface functions, characterized in that, include: The detection unit is used to detect whether there is a second hook module currently performing hook monitoring on the application programming interface function when the first hook module is detected to need to perform hook monitoring on the application programming interface function. The hook unit is used to establish a hook between the application programming interface function and the first hook module through the first association stored in the preset jump board memory address if the hook does not exist, and to monitor the hook of the application programming interface function through the first hook module. The preset jump board memory address stores a first association relationship between the first hook module and the preset jump board memory address.
8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the monitoring method for application programming interface functions as described in any one of claims 1 to 6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the monitoring method for the application programming interface function as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the monitoring method for the application programming interface function as described in any one of claims 1 to 6.